hxxps://drive[.]google[.]com/file/d/15w1DW__LmhT858vJq6vq_Jzxrw4pJ97K/view

Analysis

max time kernel
1148s
max time network
1150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 15:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/15w1DW__LmhT858vJq6vq_Jzxrw4pJ97K/view

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
9	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
4228	msedge.exe
4228	msedge.exe
688	identity_helper.exe
688	identity_helper.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2840	4228	msedge.exe	82
PID 4228 wrote to memory of 2840	4228	msedge.exe	82
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 3548	4228	msedge.exe	83
PID 4228 wrote to memory of 548	4228	msedge.exe	84
PID 4228 wrote to memory of 548	4228	msedge.exe	84
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85
PID 4228 wrote to memory of 4864	4228	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/15w1DW__LmhT858vJq6vq_Jzxrw4pJ97K/view
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd875a46f8,0x7ffd875a4708,0x7ffd875a4718
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2684920892998316705,11487085317150151128,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
9a20fcbf8821ab0c9c2b2ff0a92c7ab9

SHA1
1d6eb1e88edcfe479ef5468b0a27c714ca6938a3

SHA256
c6900a865f6c3a4157d8a1abf980d2d8f882d12ddafc86340c5d97d471912f22

SHA512
d9c38e3243202a8dcf141a520e4c8cf98d2b24ba94f492bc1862957c715fce71ae701f0dc09119b3c802a35778c63451330a525988d192df39f13f124dba81ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d6a59037108e124d5f9453864c570e51

SHA1
5539d2583b9b195d0379e63385349e3c7c5b6fa2

SHA256
2008883f3ed28a29f4ae8623acc798043808bda8c5f5b6c2821a85b3b6c83963

SHA512
1c4567f1a8078437738994b29d8dff0f05b158a127e488ac88c87b56ba3189aba9f503bc4853f3797c29582c943e650838d510a1bb5375b04e548add1116f49d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
accd146d65cd3324f3f3b66041939732

SHA1
9a1dfc44e14d50c3486f8f394449082470eee81d

SHA256
26cfc2332af24c633190f6078f98f59afc2fa1cd6596a5e9669f43c9eadcd9f8

SHA512
133b82704c58e9aec76e72655fd79d26477182f46e481e9e9d70a94ad2400dd3a9536fd7b9308bada64864a5f9f13befcd2d00a23c6d2fe500f3aa0590a2e9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
470b9ecdffa9636b5b1400d4078976f0

SHA1
2d151f6cbed872fe22ce215fac8dfc3ec27420d3

SHA256
9e4838c47f9d7714b6817f99338674a070d9e18dc7a102bed35db47bb2dface3

SHA512
25e4114f0e8dc23f24a6bff04584efbb8762a9d903fb4b22a8d0b57a15715dd3904d2a5516db90a58c528c2ae96ac7b47f38f41a51fc9bb70c0c3b4daa3ad6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
9a6cc1e1ee0fd5d00700984aa468176a

SHA1
460d0d8c48eb29c326bea57f939885a47ce3fb8d

SHA256
4bbe04bd1c315e4b56c65b04fff6766e579167b086be7b5ddcad53995738f9ba

SHA512
af3a41b24785414abca939c7b90887aa6287dbb2fd9319f13f9dcdedb008955779554513d188f1d884d81d3dfc8480252b16306c68f29001b96da977015d4595

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e5f3715cee2b713dbe7183adb90061ac

SHA1
73e5dad34c998ae405311e0b343029da261c023c

SHA256
1adb47cdfae0f33e44b6ab8ac0cdcb6c359ac1c30182dc698f6de4867779a2cb

SHA512
295ae52e6c00809b86cac6221ebf24b2ffb693625cf544f62875d30619d7acadaf146b104e7802d55676c59d74253c6a6a4c7c7c7135429142b68ef804d864f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ce06cbb917c2c54aee273c8b48641e8f

SHA1
bad236cf5c33e231921144bf723ce3a5e7ddb655

SHA256
80f11634ca94615032ff7c9713e77e21cba711cecfa5d0de6787f372f1becc39

SHA512
a680daa60cdde481f1bb2b5d7f5e646681bcff144cd937b4c5071028abda8e1c4906102e2676d462e5972f94763b2176abeba1ca86f893a6a46e1f4432cf4488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
fb1deb70aeaee31b9c2e7c8a6656e89e

SHA1
d72e394d8d392ccf97577ca1badcd86eaa157a9f

SHA256
2e13ca9e2b4c46bb23d7af63df3dfb56952edb7819ebbe9043a0129c784a0457

SHA512
14a0c564dfac8e8390d5748ac377f62d9ab0d1129f56d63596ff760e2cee05b36600df38014e30ff6fbc072d8539dbb1104e200532ecf8092b169e5945c973bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
b7d45086815e53539c9a540e63a2a262

SHA1
407212ee9f9d454a3dc8738482d32a1f89fb23c6

SHA256
3f3c48b579f01dedc363d8025ad7d0d551d4383cbbb2c221c930030f4baca581

SHA512
bafcbb77899004f22389d96e1845beecb199cba5f9fb170ec1891638e6a9bb3fe9f3f1f97801f690f43c4919a09582c9829c20b9e1b025c07ceaeef423e1f826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6b2c6c694b371a687200afdbafc8306c

SHA1
419a1ccb7d16c37eb057f9e874da90242ff20149

SHA256
ca2c4b4c6ad44b12d113f26279880b3a3108fb9cf49ad1c7153caf9404cf2043

SHA512
c88cf946db3075c6cc4ffccb738ef74446f0d8424b0ac1d8938e4b11320813d10a4073bdc9cc2957f91c744813c05f31f07e58f37a2968c178a6e60c71e875a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
5cab1707ae8d08c855811785906e2517

SHA1
33e3048e821356179a8b05bee855d85c928d651a

SHA256
16fe2b4585d71ce9dbb4b5e68de9a9fc0811815af613fa492560a8b4b718a32f

SHA512
008b218e39346cb657495d46baf0f695ea70a0c4825e7adc7be0c59c9ff78a4a9c32c01ed0a48b02f3d0b59743ed67f50fa01cb78194e3c0bd864722107b89e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e5b04737796d600ea830cc2cb2f814c7

SHA1
ef78b8ee30893d14e04a4431317b2d22acb040cb

SHA256
e3965816680c3f15f8c610341265e8b87ff6a496b675c10cb32490be1a9a99cd

SHA512
79f4669de4aebb7760c57711386dbac7915055026adf10b693a76b554a3d4b96a31cea585b1a60f3f521aab3938c5a881e14d74c0af6264a60ae56fcf3897702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
857ef3d929a8f0fffb668cfa7f146d50

SHA1
ad5f36bb1cbafab546d63afd906495bd21539f55

SHA256
8b1a040e6385d09de0c92fd1a786c461ca975313a413d055fcaaed530888c686

SHA512
5b491a47ec5f4f162eb7540a1981e90725c50bf47ddcc2349ce65732e23b08fb73429a9831552067bc0c533d1d7ccf1e0ac595b4ff297c3446839d9256a79a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02bbdd0874428a8eab7fe21e1fde8062

SHA1
e37c3a51e7cb91523de394fe89ccd2c9dddb74f8

SHA256
3587dd28f16c25c38fb6237a912edd3139db574720a0290b679c19da2be99bc9

SHA512
313476aabbb98d5c75150c7da8f0f3d39c12e6f78f2672a687ab84a5f800c44f07c996c99d6b638f67c034843db2b614c99a2400f0b20d1d1039b0f77da131ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f8b43ae818df68438a601b6b642564b

SHA1
e7aa79c802caee75683cfa6323dae67e0e8267a7

SHA256
2321e464bf00dbd661f8ec21ad49a141ee908e52a451818e07b2c8b844be5095

SHA512
c5bacc5534470a7ccb343cd7a2621fe10f9629bbd401ff4a43d4e2ae99bfc23115fbb4c7f71b09c7bab44d520ec365fc9a99d8aafbcb51e319650bbdd3dd8399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0e485addd924ca724216e08ec2ae039

SHA1
1b6d3367d89faee27245a5854f8b66a3618892a0

SHA256
ebf9613ddc0e00098196427316c14fb67771b8a1bb2dd6883a2b2ac5ce003ec5

SHA512
9322613e9f966c870993f72c346194cca3b66b585fb2b115d2af28269d1a654479a7d720169cf69b5d085289e89dabeb3cdf39ae669ff9998290db58ccc252a6

Download Submit